fix(workspace): redact GitHub tokens in container logs

[fshehadeh-sfl]

Summary

Fixes Redmine #22792. GitHub access tokens were written to the orchestrator logs in plaintext, so anyone with read access to docker logs ve-orchestrator (or host journald/log files) could recover live GitHub credentials (OWASP A09:2021 — Security Logging Failures).

Leak locations (both in src/workspace/workspaceRunner.ts)

1. Clone URL with embedded token — the "preparing project workspace (multi push target via volume)" log logged rootCloneUrl: root.cloneUrl, which contains https://x-access-token:gho_...@github.com/....
2. GITHUB_TOKEN env var — the "agent container command" (and "review container command") debug log dumped the full dockerArgs array, including -e GITHUB_TOKEN=ghu_... in cleartext.

Fix

• Reuse the existing redactUrls helper for the rootCloneUrl field.
• Add a redactDockerArgs helper (src/utils/redactUrl.ts) that masks the value of any sensitive NAME=VALUE argument (*TOKEN*, *SECRET*, *PASSWORD*, *AUTH*, etc.), strips URL-embedded credentials, and masks stray GitHub token-shaped values. Applied to both the agent and review container command debug logs.

Tests

• tests/unit/redactUrl.test.ts — 5 new tests asserting tokens never survive redaction (clone URLs, sensitive env assignments, URL-bearing args, stray token-shaped values).

Operational note

Tokens already captured in existing logs should be rotated independently of this code fix.

Validation

• npm run typecheck — zero errors
• npm run lint — clean
• npx vitest run tests/unit/redactUrl.test.ts — 5 passed

[Copilot]

Pull request overview

This PR addresses a security issue where GitHub access tokens could be leaked into host/container logs by ensuring token-bearing clone URLs and Docker command arguments are redacted before being written to logs, strengthening the workspace runner’s operational security.

Changes:

• Redacts URL-embedded credentials when logging the root clone URL for multi-push-target workspace preparation.
• Introduces redactDockerArgs() to sanitize Docker argv arrays (sensitive NAME=VALUE envs, URL credentials, and token-shaped values) before debug logging.
• Adds unit tests to ensure redaction removes GitHub token formats across common leak patterns.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/workspace/workspaceRunner.ts	Applies redaction to clone URL and Docker argv debug logs for agent/review containers to prevent token leakage.
src/utils/redactUrl.ts	Adds redactDockerArgs() and supporting patterns for masking sensitive env assignments and token-like values.
tests/unit/redactUrl.test.ts	Adds unit coverage validating URL and Docker-argv redaction against multiple token leak scenarios.

[Copilot]

✅ Ready to approve

It removes the identified credential leaks by redacting logged URLs/Docker args and adds targeted tests to prevent regressions.

Note: this review does not count toward required approvals for merging.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 0 new
• Review effort level: Low

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.